fix(quality): resolve all 28 repo-level Codacy issues (ESLint8 suppressions + 9 code fixes) by d-oit · Pull Request #628 · d-oit/do-knowledge-studio

d-oit · 2026-08-10T06:52:14Z

Summary

Resolves all 28 repo-level Codacy issues on main (23 High, 3 Error, 2 Warning) via a mix of real code fixes and false-positive suppressions.

Root cause

.codacy.yml disables ESLint9_-prefixed rules, but Codacy's cloud analysis actually runs the legacy ESLint (v8) engine, which reports ESLint8_-prefixed pattern IDs — so every suppression was silently ineffective. Added an eslint-8 engine section with matching ESLint8_ suppressions for verified false-positive patterns.

Real code fixes (9)

File	Fix
`triz-view.tsx`	Clipboard promise: `void ... .catch()` + try/catch (no-floating-promises, no-unnecessary-condition)
`type-selector.tsx`	Removed unnecessary `?.` on in-bounds NodeList index
`command-palette.tsx`	`
`shared-primitives.tsx`	`[0]` → `.at(0)` so `?? container` fallback is type-honest
`form.tsx`	Removed dead `if (!fieldContext)` guard (never null; dereferenced above)
`use-mobile.ts`	Braces around void-returning arrow cleanup
`encrypt-export-dialog.tsx`	`void handleExport(...)` (no-misused-promises)
`export-format-grid.tsx`	Braces around void setter (no-confusing-void-expression)
`self-fix-loop.sh`	SC2015: `A && B

False positives suppressed (19)

3× SSRF (Semgrep) — all fetches guarded by validateOllamaUrl (localhost-only) / protocol + isPrivateIP checks; added inline // nosemgrep markers with justification
6× xss/no-mixed-html — React JSX components, DOM-node refs, and file downloads (not raw HTML strings executed in DOM)
8× security/detect-object-injection — indexing constant lookup tables (TRIZ_PARAMETERS, BUTTON_VARIANTS) with typed keys
2× no-unnecessary-condition — runtime-defensive optional chaining where the type system is non-nullable

Validation

tsc -p tsconfig.app.json --noEmit ✓
ESLint on all changed files ✓
95 tests across 8 affected suites ✓
shellcheck on self-fix-loop.sh ✓

… ESLint8 config suppressions)

vercel · 2026-08-10T06:52:21Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
do-knowledge-studio	Ready	Preview, v0	Aug 10, 2026 7:32am

deepsource-io · 2026-08-10T06:52:42Z

DeepSource Code Review

We reviewed changes in 63558b9...a5182f8 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

Important

Some issues found as part of this review are outside of the diff in this pull request and aren't shown in the inline review comments due to GitHub's API limitations. You can see those issues on the DeepSource dashboard.

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
JavaScript	Aug 10, 2026 7:31a.m.	Review ↗
Python	Aug 10, 2026 7:31a.m.	Review ↗
Shell	Aug 10, 2026 7:31a.m.	Review ↗
SQL	Aug 10, 2026 7:31a.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-08-10T06:53:12Z

          </button>
          <button
-            onClick={() => handleExport('encrypted')}
+            onClick={() => { void handleExport('encrypted') }}


Expected 'undefined' and instead saw 'void'

The void operator takes an operand and returns undefined. It can be used to ignore the value produced by an expression. However, this can lead to code that is difficult to understand and maintain. Historically, the void operator was used to get a "pure" undefined value, as the undefined variable was mutable prior to ES5.

deepsource-io · 2026-08-10T06:53:12Z

-    navigator.clipboard?.writeText(text)
+    try {
+      // Clipboard can be unavailable in insecure contexts; rejection is non-fatal.
+      void navigator.clipboard.writeText(text).catch(() => undefined)


Expected 'undefined' and instead saw 'void'

The void operator takes an operand and returns undefined. It can be used to ignore the value produced by an expression. However, this can lead to code that is difficult to understand and maintain. Historically, the void operator was used to get a "pure" undefined value, as the undefined variable was mutable prior to ES5.

codacy-production · 2026-08-10T06:53:28Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric Results

Complexity 0

Duplication 0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

owl-watch

🦉 OwlWatch reviewed this change — 2 new finding(s).

Additional findings:

[HIGH · tracker] Potential out-of-bounds array access in keyboard navigation (src/components/studio/views/type-selector.tsx:96)

owl-watch · 2026-08-10T06:53:42Z

        elif echo "$logs" | grep -qiE "(link|broken.*reference|404)"; then
            info "Link/reference error detected — running validate-links..."
-            [ -f ./scripts/validate-links.sh ] && ./scripts/validate-links.sh 2>/dev/null || true
+            [ -f ./scripts/validate-links.sh ] && { ./scripts/validate-links.sh 2>/dev/null || true; }


🦉 OwlWatch [MEDIUM · mason] Long function phase_fix (118 lines)

Extract failure handling logic into specific handler functions to reduce cyclomatic complexity and improve readability.

…eepsource.toml

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

owl-watch · 2026-08-10T06:55:41Z


  const handleCopy = (text: string, id: number) => {
-    navigator.clipboard?.writeText(text)
+    try {


🦉 OwlWatch [MEDIUM · mason] Long component TrizView (381 lines)

Decompose TrizView by extracting sub-components and potentially a custom hook for state/logic.

…rule

…n-bounds by construction

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

owl-watch · 2026-08-10T07:16:40Z

 const useFormField = () => {
  const fieldContext = React.useContext(FormFieldContext)
  const itemContext = React.useContext(FormItemContext)
+  // fieldContext is never null (context has a default value) and is dereferenced


🦉 OwlWatch [HIGH · tracker] Missing guard for FormField context leads to potential runtime error

The removal of the fieldContext guard in useFormField allows calling useFormState with an undefined name if the hook is used outside of a FormField provider, leading to potential runtime errors.

…pboard unavailability

owl-watch

🦉 OwlWatch reviewed this change — 1 new finding(s).

owl-watch · 2026-08-10T07:18:42Z

-              options[nextIdx]?.focus()
+              // nextIdx is always within [0, options.length) via the modulo above,
+              // and the non-empty guard runs earlier — .item() is safe to call directly.
+              options.item(nextIdx).focus()


🦉 OwlWatch [LOW · tracker] Potential for brittle code, though not a bug

The use of .item().focus() on a NodeList is safe due to prior checks, but could be clearer.

Convert the five JS-0067-flagged export function declarations (TrizView, TypeSelector, CommandPalette, useIsMobile, Overlay) to const arrow functions, the AGENTS.md-preferred form, and drop the void operator from the two JS-0098-flagged promise call sites (clipboard write, encrypted export) in favor of .catch(() => undefined), which satisfies Codacy's no-floating-promises rule without the void keyword. DeepSource reported issuesSuppressedCount: 0 for these codes despite the issue_patterns in .deepsource.toml, so the code fix is the primary remedy.

deepsource-io · 2026-08-10T07:32:43Z


 /** Accessible modal overlay with focus trap, scroll lock, and configurable layout variant. */
-export function Overlay({
+export const Overlay = ({


`Overlay` has a cyclomatic complexity of 7 with "medium" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

deepsource-io · 2026-08-10T07:32:43Z


 /** TRIZ contradiction matrix view for picking parameters and viewing suggested inventive principles. */
-export function TrizView() {
+export const TrizView = () => {


`TrizView` has a cyclomatic complexity of 27 with "very-high" risk

A function with high cyclomatic complexity can be hard to understand and
maintain. Cyclomatic complexity is a software metric that measures the number of
independent paths through a function. A higher cyclomatic complexity indicates
that the function has more decision points and is more complex.

fix(quality): resolve all 28 repo-level Codacy issues (9 code fixes +…

646bdbb

… ESLint8 config suppressions)

github-actions Bot added config scripts labels Aug 10, 2026

vercel Bot deployed to Preview August 10, 2026 06:52 View deployment

deepsource-io Bot reviewed Aug 10, 2026

View reviewed changes

owl-watch Bot reviewed Aug 10, 2026

View reviewed changes

fix(ci): use valid javascript analyzer name + skip_doc_coverage in .d…

210e621

…eepsource.toml

vercel Bot deployed to Preview August 10, 2026 06:55 View deployment

owl-watch Bot reviewed Aug 10, 2026

View reviewed changes

fix(quality): use NodeList.item() to satisfy Codacy object-injection …

b69ef04

…rule

vercel Bot deployed to Preview August 10, 2026 06:59 View deployment

fix(quality): call NodeList.item() directly — non-null per lib.dom, i…

a55c1ae

…n-bounds by construction

vercel Bot deployed to Preview August 10, 2026 07:12 View deployment

docs(plans): add Plan 112 — Codacy repo-issue remediation record

0acb7f1

github-actions Bot added the documentation Documentation improvements label Aug 10, 2026

owl-watch Bot reviewed Aug 10, 2026

View reviewed changes

vercel Bot deployed to Preview August 10, 2026 07:16 View deployment

fix(quality): SC2015 if/then form preserves set -e semantics; log cli…

30091a4

…pboard unavailability

vercel Bot deployed to Preview August 10, 2026 07:18 View deployment

owl-watch Bot reviewed Aug 10, 2026

View reviewed changes

vercel Bot deployed to Preview August 10, 2026 07:32 View deployment

deepsource-io Bot reviewed Aug 10, 2026

View reviewed changes

Conversation

d-oit commented Aug 10, 2026

Summary

Root cause

Real code fixes (9)

False positives suppressed (19)

Validation

Uh oh!

vercel Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepsource-io Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

Expected 'undefined' and instead saw 'void'

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

Expected 'undefined' and instead saw 'void'

Uh oh!

codacy-production Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot left a comment

Choose a reason for hiding this comment

Uh oh!

owl-watch Bot Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

`Overlay` has a cyclomatic complexity of 7 with "medium" risk

Uh oh!

deepsource-io Bot Aug 10, 2026

Choose a reason for hiding this comment

`TrizView` has a cyclomatic complexity of 27 with "very-high" risk

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Aug 10, 2026 •

edited

Loading

deepsource-io Bot commented Aug 10, 2026 •

edited

Loading

codacy-production Bot commented Aug 10, 2026 •

edited

Loading